Sniffing the Rigol's internal I2C bus

[andyturk]

Is the name of the GEL file important or just the fact that it is a GEL file enough?

The name *is* important. For my scope, it wouldn't recognize the file unless it was named DS4000Update.GEL

[mtdoc]

I've tried two different USB sticks.  One is under 1G.
Tried FAT16 and FAT32.

Is the name of the GEL file important or just the fact that it is a GEL file enough?

If you are using cybernet's firmware you must rename the file to DS2000Update.GEL

[StepDIR]

Thanks everyone.

 Yes I am using cybernet's firmware and I had to name my file DS2000Update.GEL since I have a DS2000 series.

[Teneyes]

Thanks everyone.
 Yes I am using cybernet's firmware and I had to name my file DS2000Update.GEL since I have a DS2000 series.

Just for reference,
I have one USB stick and on loading firmware to a Rigol,
I see the stick LED flash when it is inserted, but no 'Chan 1' flashing !
However,
when I remove and re-insert it a second time, then the 'Chan 1' begins to flash
and the new firmware is loaded.

File must be named DS2000update.GEL  , NOT  DS2000update00_01_01_00_01.GEL or whatever

[stormbr]

Solved to me, i haven't renamed to DS2000Update.GEL and dont needed uninstall/reinstall the Keys.

BW Limit - 20M - 100M - 200M
Model Name: 2202 (not change to 2303).
Serial: not change to DS2A00001.
Time base: 1ns

Note:

I used a sandisc 4gb pendrive, black/red and all made in plastic, the same that Dave use in your review.

Thanks to all community.

Cheers.

[staze]

So did your keys from before the hacked firmware stick? Still have decode options, etc?

I guess now all that's left is CAN decode.

[stormbr]

So did your keys from before the hacked firmware stick? Still have decode options, etc?

I guess now all that's left is CAN decode.

No problem with keys, all options are official version and not opened "can decode" function.

Just update to cybernet firmware and enjoy.

[flolic]

JW pulse generator, DS2072 scope with 50ohm pass through terminator. Cybernet's 350MHz modified firmware. Scope HW 1.0

[maelli]

@frolic

some more playing around with 300 and 200Mhz setting.
Williams generator with piece of coax and a trimcap.
Aim was to generate a flat and slightly longer (if 4.5 nanosecs are long)
pulse, since too short pulses show to optimistic rise times.

Still using the 1:10 probe that came with the DS2000.
Shortest possible earth connection (not even the springy thingy).
DS2072 hw version 2, with Cybernet's firmware

Yellow trace full BW, pink trace 200Mhz.
The 200Mhz setting is so much slower ;-)

[flolic]

@Maelli, yes, you are right
I forgot to adjust trimmer on my pulse generator. Now reading are almost the same as yours

[Co6aka]

DS4014 frequency response based on Co6aka measurements...

Interesting how the knee is right at 500MHz, and the highest BW DS4K is 500MHz.

I forgot to add: I also generated some 95% modulated AM signals at 1GHz which, though attenuated, looked exactly as expected; seems the scope is still usable at 1GHz. When I get an opportunity I'll do some more upper-frequency-limit exploration, and if anyone wants me to also try some specific tests send me a PM with the details.

[andyturk]

... I also generated some 95% modulated AM signals at 1GHz which, though attenuated, looked exactly as expected; seems the scope is still usable at 1GHz.

That's the same conclusion that Connor Wolf came to a while back. The info is buried in the thread somewhere, but the input amplifiers are configurable for bandwidth and are spec'd to handle 900MHz, if I remember correctly. It could be that cybernet's DS4K mod simply tricks the scope into thinking it's a 500MHz model, without touching the actual configuration of the input amps. I.e., the DS4054 may still be limiting the bandwidth under software control.

The way to find out would probably be to put a logic analyzer on the SPI lines for those input amps and see what's being sent to them. ve7xen tried that on his DS2K, and found that the input amps were still limited even when the scope's UI said otherwise.

[cybernet]

im pretty sure the change int he model type id (thats what the firmware file hack does) affects the SPI based filter chip, indirectly.
but: atm i believe the FPGA or a micro core in the FPGA is actually running the SPI bus, the bfin is a slave - so the actual value that gets set in the SPI based filter chip is unknown to me (but it does upgrade, that im pretty certain)

[Carrington]

Another question: What chip sets the DS4000's BW?

[thetooth]

At the risk of sounding retarded, is the DS2000A hackable at this point?, i've skimmed backwards through to page 60 where people were talking about it but there wasn't any solution.

My DS2072A arrived today and i've been burning through the trail like anything(2000 minutes is NOTHING), since i really need the 56mp/s option but am flat broke after buying the scope. Of course tried the keygen to no avail using manual input and serial.

I'm willing to do FW dump if its needed, also i have a copy of the latest GEL file.

And somewhat off topic, dose the DS2000 normally crash frequently? i've had it on for probably 4hrs total, and its crashed 5 times so far, 3 when using the decode functions and the others just randomly.

[Avotronics]

At the risk of sounding retarded, is the DS2000A hackable at this point?, i've skimmed backwards through to page 60 where people were talking about it but there wasn't any solution.

My DS2072A arrived today and i've been burning through the trail like anything(2000 minutes is NOTHING), since i really need the 56mp/s option but am flat broke after buying the scope. Of course tried the keygen to no avail using manual input and serial.

I'm willing to do FW dump if its needed, also i have a copy of the latest GEL file.

And somewhat off topic, dose the DS2000 normally crash frequently? i've had it on for probably 4hrs total, and its crashed 5 times so far, 3 when using the decode functions and the others just randomly.

DS2000A Hackable yet? No.
But I don't think anyone has supplied jtag dump yet for the A series.
I really want to order a DS2000 while there are still some non-A versions left, unfortunately I'm skint this month.
I'm not convinced that the A version will ever be hackable because I think Rigol have done something to stop (make harder) the hackability of the newer models.  Of course, I could be wrong 

I would suggest you contact the supplier with your crashing problem. But you should check the firmware version in case there is an update.

Someone will be a long shortly who knows more.

[AndersAnd]

At the risk of sounding retarded, is the DS2000A hackable at this point?

No, not yet.

I'm willing to do FW dump if its needed, also i have a copy of the latest GEL file.

Uploading a FW dump and GEL file would probably help a lot with hacking it, nobody has uploaded this for DS2000A yet, so nobody without a DS2000A would be able to help with hacking it.
The files are too big to attach at this forum, so you would need to use a 3rd party file hosting site like www.filedropper.com where cybernet has uploaded his custom firmwares, or mail them to the poster above (Avotronics) who hosts files for Rigol hacking on his website here: rigol.avotronics.co.uk

[Teneyes]

dose the DS2000 normally crash frequently? i've had it on for probably 4hrs total, and its crashed 5 times so far, 3 when using the decode functions and the others just randomly.

  NO , I cannot remember if it ever froze, bugs Yes, function failures ( buttons) Yes

[AndersAnd]

And somewhat off topic, dose the DS2000 normally crash frequently? i've had it on for probably 4hrs total, and its crashed 5 times so far, 3 when using the decode functions and the others just randomly.

What's the firmware and hardware versions for your DS2000A?
You said you have the latest GEL file, what version is this and has it been installed yet?
I think you are the first member on here to mention having received a new GEL file for DS2000A.

[apelly]

I'm willing to do FW dump if its needed

Do it! My JTAG stuff is still in the mail. Will be more than a week before I get set up and can dump everything.

also i have a copy of the latest GEL file.

Post it already. What's the hold up? 

Also... I've never experienced a crash with mine. Maybe RMA before you open it?

[thetooth]

Heres the firmware i got from rigol: http://thetooth.name/dev/DS2000(DSP)update.rar i have not installed it yet because they said it was the same version and i've read before that updating causes you to loose trial, however i don't think its anything new, internal date is 24/06/2013 so i as a wild guess, they're using the same firmware but have changed something else to break the keygen(or the keygen's algo is just incorrect for the newer models ).

Heres the version info, i'm not sure how to get any extended info like i've seen in other posts, but maybe they were just ds4000's

[marmad]

Heres the version info, i'm not sure how to get any extended info like i've seen in other posts

Bottom of this post.

[alank2]

thetooth that is the same as the latest non A firmware, so either Rigol gave you the wrong firmware or they are going to use the same firmware for both the A and non A scopes.  Probably they gave you the wrong one though as your scope shows something newer - I wouldn't load it!

Also, it isn't a rar but a zip you've attached.

[AndersAnd]

Also, it isn't a rar but a zip you've attached.

I'm surprised WinRAR doesn't complain, regardless if this file ends on .rar or .zip.
It just opens it as if it had the correct extension name, whether you name it .rar or .zip.

[thetooth]

thetooth that is the same as the latest non A firmware, so either Rigol gave you the wrong firmware or they are going to use the same firmware for both the A and non A scopes.  Probably they gave you the wrong one though as your scope shows something newer - I wouldn't load it!

Also, it isn't a rar but a zip you've attached.

yeah i gathered, also funnily enough the rigol rep sent me the image as a jpg file with instructions to rename it since he seemed to think it would be eaten.

I sent an email back to ask if they were sure this was for the A version so might see something new after all.


That sure did take a few attempts, i think the threshold is about 500ms lel